Hello, World! How can someone steal your files from your power supply,
Why North Korean hackers are exploiting Internet Explorer, And Apple won’t scan
all your photos after all. That’s all coming up in today’s roundup of cyber security tech news.
There’s a new technique to covertly exfiltrate files from air-gapped computers, and it involves
exploiting a computer’s power supply - the method, outlined in a new research paper, allows a hacker
to remotely receive files from up to 2 metres away - without using WiFi, bluetooth or the internet.
The technique is called “COVID-bit” - which is kinda confusing, since it doesn’t have anything
to do with covid. But anyway, it works based on the fact that all computers use what’s called a
“Switched mode power supply”, this technology means that the power supply’s output voltage
is controlled by switching the input voltage on and off at very high frequencies. The rate of
switching depends on how much power the computer is consuming, so as the paper explains “By
regulating the workload of the CPU, it’s possible to govern its power consumption and hence control
the momentary switching frequency”. And all this switching has the side effect of emanating
small amounts of electromagnetic radiation. So you can probably see where this is going… by
using this principle, malware on a victim PC would take a file, and run it through an algorithm,
encoding it into a CPU workload which would then be run on the processor. The power supply would
be forced to account for the variations in power consumption by modulating the rate at which it
does its switching, which in turn would create a stream of electromagnetic radiation. And given
the frequencies that can be generated from this just so happen to be within what a phone’s audio
chip can detect, the researchers connected a small loop antenna, which looks something
like this - to a phone’s 3.5mm audio jack. There’s a demonstration video, that shows a string
of text transmitted to a phone behind a wall - so this does work. And by it’s very nature this
exfiltration method doesn’t need admin privileges, and it can run in a VM, which is a big bonus.
As for transfer speeds though, well - we’re looking at a maximum of 1000 bits per second. So
to transmit a megabyte you’d be waiting well over 2 hours. And I guess that’s a good segue into the
impracticalities of using this in the real world. Firstly, you would have to be within 2 metres of
the computer - and since the communication is only 1 way, the time and date of the exfiltration would
have to be pre determined in malware. And this is all assuming the room housing the
air gapped computer, isn’t encased in a faraday cage. And we haven’t even gotten to the problem
of how an attacker would load this malware on to the air gapped PC in the first place.
So this technique is probably never going to see the light of day, but the researcher behind it, is
one “Dr Mordechai Guri” is actually quite famous for coming up with different ways to exfiltrate
data from air gapped computers, whether it’s repurposing a sata cable to act as an antenna,
or encoding data in sound waves emitted in the resonance frequencies of a phone’s gyroscope,
it seems every few months he releases a new paper on some crazy new technique to exfiltrate data
from computers in air gapped environments. And I look forward to covering his next one.
North Korea’s infamous hacking group, Lazarus - has hit a new low. They’ve been discovered using
the recent Seoul Halloween crush to spread malware… which exploits Internet Explorer
zero days - and the strange thing is, victims don’t even need to use Internet Explorer to be
hacked by this. The depraved new operation, started with a Microsoft word document being
circulated in South Korea. Disguised as being published by a South Korean government agency,
it claims to be an official investigation into the crush, in which over 150 people died.
Because the document is downloaded from the internet, it comes with a warning, and a button
you have to click if you want to “Enable Editing”. This has nothing to do with Office Macros - that
would prompt a different warning which is a lot more ominous, and not something you can
just override with just a simple click. If a user does hit “Enable Editing” they’ll set in motion
a series of events. Firstly, the document will download a template file in the background - which
is actually a perfectly legitimate feature of Microsoft word… and whilst it can be repurposed
for malicious intent, usually this is to download malware laden macros, but in this case the North
Koreans had other plans. After being downloaded the template proceeds to render HTML within the
document - and this is where our old friend, internet explorer makes a cameo appearance. You
see, whilst Internet Explorer has officially been deprecated and replaced with Edge, it lives on in
the backend of some Microsoft applications, one of those being Microsoft word - which
will render HTML content using Internet Explorer regardless of whatever your default browser is.
And it just so happens that there’s a zero day in Internet Explorer’s Jscript Engine - Jscript,
not to be confused with Javascript is a Microsoft owned scripting language, which is all but
dead these days, but it’s still supported in Internet Explorer for compatibility reasons.
The vulnerability allows for arbitrary code to be executed on the victim PC, which in this
case infects the victim with malware - exactly what that malware is, well we just don’t know.
Because this campaign was only really investigated after the malicious document was uploaded to
virus total a bunch of times. Which caught the eye of Google’s threat analysis group,
prompting them to investigate. By this point North Korea had discontinued the campaign. And
because of this, we don’t even know who the actual target of the campaign was,
I mean - it’s unlikely North Korea would burn a zero day by just randomly spewing phishing emails.
But previously when North Korea was spotted exploiting Internet Explorer - because of course
this wasn’t their first time - they were targeting the readers of dailynk.com - a South Korean online
newspaper dedicated to covering issues related to their Northern neighbour, usually in a negative
light. After North Korean hackers compromised the site in late 2021, visitors were served malicious
javascript which was capable of exploiting Internet Explorer. Bluelight malware was dropped
on the targets which gave Lazarus a backdoor into their systems. In this watering hole attack,
the North Koreans were probably hoping to get lucky, infecting high profile anti North
Korean activists - the game plan might’ve been something similar in their latest campaign.
Apple, has just killed their plans to scan iPhones for images of child exploitation.
They announced the initiative back in August of last year - a new iOS feature,
that would scan every photo you have on iCloud for what Apple refers to as “CSAM”. Idea being,
the hashes of thousands of known CSAM images would be stored on every iOS device - with
each of your photos being compared against this database. In the case of a match being found,
“Apple then manually reviews each report to confirm there is a match, disables the user’s
account, and sends a report to the “National Center for Missing & Exploited Children”.”
This idea, coming from Apple wasn’t half-baked, their announcement of the plans were launched
alongside a white paper where they introduced a new hashing technique, capable of matching photos
even if they had been cropped, downscaled or even edited. And there were various privacy safeguards
built into the system, like it was done locally on your iPhone rather than in the cloud, and Apple
made sure they were only technically capable of reviewing photos if an “iCloud Photos account
crosses a threshold of known CSAM content”. Regardless, Apple of course received a pretty
substantial backlash. I mean - they say the road to hell is paved with good intentions…
and whilst this technology might only be used to scan for CSAM today, there’s no telling what it
could be used to scan for tomorrow. So, just one month after announcing the plans, Apple put the
project on hold. And it’s been radio silence since then, until a few days ago when Apple
announced they were killing the idea entirely. Apple made the announcement alongside the
introduction of what they’re calling “Advanced Data Protection” for iCloud backups. Which is
Apple-speak for end-to-end encryption. This is long long overdue, in fact it was previously
reported in 2020 that Apple had dropped plans for end-to-end encryption after the
FBI complained about it - what caused Apple to reverse their reversal? Who knows. Regardless,
it is pretty bad news for law enforcement - who up until now have been able to request copies of
iCloud backups straight from Apple. And given iPhones make up half the US smartphone market,
losing access to this overnight is going to make their jobs more difficult. That being said,
“Advanced Data Protection” is not enabled by default, you do have to manually opt in.
This video was made possible by Octopart - a website I've been relying on over the last few
years in my electronics business. Octopart.com is essentially your component sourcing swiss
army knife - making it simple to keep tabs on component stock levels in real time throughout a
range of distributors - which is pretty important given the current component supply situation,
you can also easily grab datasheets and cad models for components when you need
them. The best part is it's free to use, and Octopart is integrated right into altium 365,
if you want to give altium a go you can find your free trial link in the description.
As always, thanks for watching and I’ll see you in the next video, have a good one!